Malicious PDF — malware analysis report

Static analysis result for SHA-256 25bd205aa7ffdcb0…

MALICIOUS

PDF

49.0 KB Created: 2020-08-31 07:45:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7fbb966db801e2b0579240db1a2fc5d8 SHA-1: 8a2df0e70b72035a7e1550e222742377676052c7 SHA-256: 25bd205aa7ffdcb0636581bc2e8a050695627eb7bd76492b80964f55bb5b02cb
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a malicious redirector link disguised as a download button, indicated by the 'PDF_MALICIOUS_REDIRECTOR_LINK' and 'SE_DOWNLOAD_BUTTON' heuristics. The embedded URL 'https://ttraff.cc/wix?keyword=samsung+galaxy+s6+ringtone+length' is the primary indicator of malicious intent, likely leading to a phishing or malware distribution site. The PDF also hosts a link farm, suggesting an attempt to manipulate search engine results.

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=samsung+galaxy+s6+ringtone+length
    • https://cdn.shopify.com/s/files/1/0436/1958/2110/files/valajiximusujerigerorum.pdf
    • https://cdn.shopify.com/s/files/1/0437/1641/1547/files/66615227527.pdf
    • https://cdn.shopify.com/s/files/1/0438/3365/5446/files/newmar_rv_service_manual.pdf
    • https://cdn.shopify.com/s/files/1/0428/5834/8700/files/dizuvilerigawetoke.pdf
    • https://cdn.shopify.com/s/files/1/0461/7905/7817/files/company_earnings_reports_this_week.pdf
    • https://static.usrfiles.com/ugd/b8c837_b50ae81c0c974ae18ca70c8758801094.pdf
    • https://cdn.shopify.com/s/files/1/0432/5782/3390/files/management_accountant_job_description.pdf
    • https://cdn.shopify.com/s/files/1/0428/9835/8432/files/78539107281.pdf
    • https://cdn.shopify.com/s/files/1/0433/9122/1911/files/applied_mathematics_syllabus.pdf
    • https://cdn.shopify.com/s/files/1/0431/0233/9232/files/35573054922.pdf
    • https://static.usrfiles.com/ugd/efb3f0_857e6eae0bd34150b32ff11b26449177.pdf
    • https://static.usrfiles.com/ugd/9a242c_b5294372232346f69a75e78e75e3fdb6.pdf
    • https://static.usrfiles.com/ugd/b8c837_3558ca53279742199c2159c93711a0ab.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000819c.bin
af43c3a34e96e9cb0b2f9198019fcd1e496dfd5331f8e4a2b1b16c8638bcd86f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x819C 5528 bytes
font_01_sfnt_off0000943c.bin
ca8b9008034dbbe94ff29495ab9661a5b8d65e94395259f71bcb36596e679b47		 pdf-font-stream PDF embedded font (sfnt) at offset 0x943C 10308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.